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Amendments to the Claims : 

The listing of claims will replace all prior versions, and listings of claims in the 
application: 

Listing of Claims: 

Claims 1 -2 (cancelled) 

Claim 3. (previously presented) A programmable controller for use with a 
monitoring device, said programmable controller including: 

at least one input interface and an input register for connection to process plant 
and/or machinery to provide sampled and stored input data in digital form, 

at least one output interface for connection to process plant and/or machinery to 
receive output data in digital form, 

programmable logic hardware including a plurality of basic logic elements and 
electrically configurable interconnections, said interconnections configurable to 
interconnect the logic elements as a user control program circuit and to connect the user 
control program circuit to said input and output interfaces, 

program loading means to enable the user to configure the programmable logic 
hardware as a circuit implementing a user control program prior to initiating control of 
the associated process plant and/or machinery, 

a user control program implemented as an electrical logic circuit configured in said 
programmable logic hardware, with said user program circuit connected to said input and 
output interfaces and wherein: 

said programmable logic as configured has a plurality of state data storage units 
storing the user program circuit state data, and a means of access to said state data storage 
units, 

a monitoring device may be connected via said means of access to said state data 
storage units, and 

said means of access to said state data storage units enables said monitoring device 
to read data values from said state data storage units and to write data values to said state 
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data storage units while the user control program continues to perform control functions. 

Claim 4. (previously presented) The programmable controller as claimed in claim 3 with 
an operating cycle of at least two non-overlapping sequential intervals, and wherein, 

said input register operates to sample and store the input data within a first said 
interval ("logic processing interval"), 

said programmable logic circuit includes clocking means that applies clock pulses in 
said logic processing interval as required by the user control program circuit, said logic 
processing interval allowing the user control program circuit signals to settle, and 

said means of access to said data storage units enable said monitoring device to read 
data from and/or write to said state data storage units during a second said interval ("data 
access interval"). 

Claims 5-7 (cancelled) 

Claim 8. (currently amended) The programmable controller as claimed in claim 4 with 
duplicated hardware to facilitate program swapping operations including: 

at least two separately configurable sections of programmable logic hardware for 
separately configurable user control program circuits, 

output selector means to selectively connect one of said programmable logic 
hardware sections to said output interfaces via the output register, and 

m e ans to support program swap op e rations adapt e d to p e rform th e st e ps of: 

configuring a n e w us e r control program in incoming said programmabl e logic 

hardwar e s e ction not conn e ct e d to said output int e rfac e , and 
subs e qu e ntly, all within on e said data acc e ss int e rval: 

r e ading stat e data from said storag e units of th e outgoing said programmabl e logic 

hardwar e s e ction, 

optionally writing th e state data relocation means for writing, within one data access 

interval state data from an the-outgoing said programmable logic hardware section into th e 
incoming said programmabl e logic hardwar e s e ction so that th e data is writt e n to the state 
data storage units of an incoming said programmable logic hardware section that have the same 
user control program functions as those from which it was read; 
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disconn e cting said outgoing programmabl e logic hardwar e section from said output 

int e rfac e s, and 

conn e cting said incoming programmabl e logic hardwar e s e ction to said output 

interfac e via th e output r e gist e r . 

Claim 9. (currently amended) The programmable controller as claimed in claim 8 , wherein 
said state data relocation means comprises including m e ans to support r e location of state 
data from th e outgoing programmable logic hardwar e s e ction to th e corr e sponding stat e data 
storag e unit in th e incoming programmabl e logic hardwar e s e ction including : 

relocation address storage writable by said monitoring device, corresponding with 
said state data storage units, 

secondary state data storage to save data from said state data storage units, 

selection means for selecting to s e l e ct either a non-relocated address or a relocated 
address with which to access said secondary state data storage, and 

data relocation means for performin g, within one said data access interval the steps 

of: 

(i) — loading said r e location addr e ss storag e with addr e ss e s suppli e d by 

said monitoring d e vic e ; and within on e said data acc e ss int e rval, 

(j_ii) reading a state data bit from said outgoing a -programmable logic hardware 
section, 

(nm) writing said state data bit into said secondary state data storage at an address 

stored in said relocation address storage, 
(iii w) repeating steps (jji) and until all required bits have been relocated and 

transferred, 

(iy_v) reading a state data bit from said secondary state data storage, 

(v_vi) writing said state data bit into said outgoing the same or a different 

programmable logic hardware section at the same address at which it was 

located in said secondary state data storage, and 
(vi_¥H) repeating steps Qvv) and (vyi) until all required bits have been transferred. 

Claim 10. (previously presented) A programmable controller said programmable 
controller including: 
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at least one input interface and an input register for connection to process plant 
and/or machinery to provide sampled and stored input data in digital form, 

at least one output interface for connection to process plant and/or machinery to 
receive output data in digital form, 

programmable logic hardware including a plurality of basic logic elements and 
electrically configurable interconnections, said interconnections configurable to 
interconnect the logic elements as a user control program circuit and to connect the user 
control program circuit to said input and output interfaces, 

program loading means to enable the user to configure the programmable logic 
hardware as a circuit implementing a user control program prior to initiating control of 
the associated process plant and/or machinery, 

a user control program implemented as an electrical logic circuit configured in said 
programmable logic hardware, with said user program circuit connected to said input and 
output interfaces and means to support circuit failure detection including 

at least two separately configurable sections of programmable logic hardware 
configurable with identical user control program circuits, said input register providing 
identical settled input values, that are not transient at the time of sampling by the user 
control program circuit, to each user control program circuit, and, 

failure detection means comparing a set of output values of each said programmable 
logic section with the corresponding set of output values of each other section, and 
indicating failure of said programmable logic hardware if the sets of settled output values of 
said sections are not identical. 

Claim 11. (previously presented) A programmable controller said programmable 
controller including: 

at least one input interface and an input register for connection to process plant 
and/or machinery to provide sampled and stored input data in digital form, 

at least one output interface for connection to process plant and/or machinery to 
receive output data in digital form, 

programmable logic hardware including a plurality of basic logic elements and 
electrically configurable interconnections, said interconnections configurable to 
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interconnect the logic elements as a user control program circuit and to connect the user 
control program circuit to said input and output interfaces, 

program loading means to enable the user to configure the programmable logic 
hardware as a circuit implementing a user control program prior to initiating control of 
the associated process plant and/or machinery, 

a user control program implemented as an electrical logic circuit configured in said 
programmable logic hardware, with said user program circuit connected to said input and 
output interfaces and 

means to support circuit failure detection and connection including: 

at least three said separately configurable sections of programmable logic hardware 
configurable with identical user control program circuits, said input register providing identical 
settled input values, that are not transient at the time of sampling by the user control program circuit, 
to each user control program circuit, and 

failure detection means to compare a set of output values of each said programmable 
logic hardware section with the corresponding set of output values of at least two other said 
sections, and 

output processing means to pass a set of correct output values to the control outputs 
via the output register and ensure incorrect output values as indicated by said failure 
detection means do not propagate to the control outputs; 

wherein said failure detection means determines that a programmable logic 
hardware section has failed if the set of settled output values of said programmable logic 
hardware section is not identical to at least one of the sets of settled output values of the 
other programmable logic hardware sections, identifies any unmatched sets of outputs as 
coming from a failed programmable logic hardware section, and indicates the failure of that 
programmable logic hardware section. 

Claim 12. (previously presented) The programmable controller as claimed in claim 10 
including a plurality of said failure detection means with the sets of outputs from each 
section of programmable logic hardware provided as inputs to each said failure detection 
means, and 

detection of a failure by any one of the two or more failure detection means indicates 
that a failure has occurred. 
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Claim 13. (previously presented) The programmable controller as claimed in claim 11 
including a plurality of said failure detection and correction means with the sets of outputs 
from each of the at least three sections of programmable logic hardware provided as inputs 
to each of the failure detection and correction means, and wherein: 

indication of a difference between the sets of output values of any two sections of 
programmable logic hardware by any one or more of the failure detection means indicates 
that a failure has occurred, and 

at least two or more failure detection circuits must agree that a particular section of 
programmable logic hardware is operating correctly before the set of output values from that 
said section is deemed to be correct, and 

said output processing means passes a set of correct output values to the control 
outputs via the output register and ensures incorrect output values, as indicated by said 
failure detection means, are not propagated to the control outputs. 

Claim 14. (previously presented) The programmable controller as claimed in claim 13 
including exception evaluating and handling means which ensures that the controller 
responds appropriately when the number of sets of concurrently correct output values 
deemed desirable as a safety margin does not exist, the minimum said number being two. 

Claim 15. (previously presented) The programmable controller as claimed in claim 3 
wherein said programmable controller receives input signals from duplicate sensors and said 
user control program includes at least one input signal monitoring function block, said 
monitoring block determining the invalidity of an input signal by a comparison of said 
duplicate input signals using criteria defined as part of the function block as suitable to 
identify signals in error, and indicating an input signal error if said input signal is deemed 
invalid. 



Claim 16. (previously presented) The programmable controller as claimed in claim 15 
wherein said duplicate sensors include three or more matching sensors and the respective 
said input signal monitoring function block determines the invalidity of an input signal from 
a comparison of said matching input signals, and determines the invalid signal as the odd- 
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one-out, and passes a single copy of the valid signals as the input signal. 

Claim 17. (previously presented) The programmable controller as claimed in claim 4 
including means to support circuit failure detection including 

at least two separately configurable sections of programmable logic hardware 
configurable with identical user control program circuits, said input register providing 
identical settled input values, that are not transient at the time of sampling by the user 
control program circuit, to each user control program circuit, and, 

failure detection means comparing a set of output values of each said programmable 
logic section with the corresponding set of output values of each other section, and 
indicating failure of said programmable logic hardware if the sets of settled output values of 
said sections are not identical. 

Claim 18. (previously presented) The programmable controller as claimed in claim 4 
including means to support circuit failure detection and correction including: 

at least three said separately configurable sections of programmable logic 
hardware configurable with identical user control program circuits and with identical 
input values, and 

said identical input valves provided in a way so as to be settled and not transient at 
the time of sampling by the user control program circuit, and 

failure detection means to compare a set of output values of each said programmable 
logic hardware section with the corresponding set of output values of at least two other said 
sections, and 

output processing means to pass a set of correct output values to the control outputs 
via the output register and ensure incorrect output values as indicated by said failure 
detection means do not propagate to the control outputs; 

wherein said failure detection means determines that a programmable logic 
hardware section has failed if the set of settled output values of said programmable logic 
hardware section is not identical to at least one of the sets of settled output values of the 
other programmable logic hardware sections, identifies any unmatched sets of outputs as 
coming from a failed programmable logic hardware section, and indicates the failure of that 
programmable logic hardware section. 
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Claim 19. (previously presented) The programmable controller as claimed in claim 18 
including a plurality of said failure detection and correction means with the sets of outputs 
from each of the at least three sections of programmable logic hardware provided as inputs 
to each of the failure detection and correction means, and wherein: 

indication of a difference between the sets of output values of any two sections of 
programmable logic hardware by any one or more of the failure detection means indicates 
that a failure has occurred, and 

at least two or more failure detection circuits must agree that a particular section of 
programmable logic hardware is operating correctly before the set of output values from that 
said section is deemed to be correct, and 

said output processing means passes a set of correct output values to the control 
outputs via the output register and ensures incorrect output values, as indicated by said 
failure detection means, are not propagated to the control outputs. 

Claim 20. (cancelled) 

Claim 21. (currently amended) The programmable controller as claimed in claim 4 
wherein said means of access for reading and writing said state data is in configur e d into 
said user control program circuit. 

Claim 22. (currently amended) The programmable controller as claimed in claim 

21 including: 

an output register to store said output data for said output interface, and wherein 
said user control program circuit includes dual purpose flip-flops , each dual 
purpose flip-flop us e d for th e dual purpos e of p roviding the normal logic processing 
circuit storage function of storing said user program state data and transporting said user 
program state data into and out of the user control program circuit. 

Claim 23. (currently amended) The programmable controller as claimed in claim 

22 with duplicated hardware to facilitate program swapping operations including: 
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at least two separately configurable sections of programmable logic hardware for 
separately configurable user control program circuits, 

output selector means to selectively connect one of said programmable logic 
hardware sections to said output interfaces via the output register, and 

means to support program swap op e rations adapt e d to p e rform th e st e ps of: 

configuring a n e w us e r control program in incoming said programmabl e logic 
hardwar e s e ction not conn e ct e d to said output int e rfac e , and 

subs e qu e ntly, all within on e said data acc e ss interval: 

reading stat e data from said storag e units of th e outgoing said programmabl e logic 
hardwar e s e ction, 

optionally writing th e stat e data from th e outgoing said programmabl e logic 
hardwar e s e ction into th e incoming said programmabl e logic hardwar e s e ction so that th e 
data is writt e n state data relocation means for writing, within one data access interval, 
state data from an outgoing said programmable logic hardware section to the state data 
storage units of an incoming programmable logic hardware section that have the same 
user control program functions as those from which it was read 7 

disconn e cting said outgoing programmabl e logic hardwar e s e ction from said 
output int e rfac e s, and 

conn e cting said incoming programmabl e logic hardwar e s e ction to said output 
int e rfac e via th e output r e gist e r . 

Claim 24. (currently amended) The programmable controller as claimed in claim 
23 including means to support r e location of stat e data from th e outgoing programmabl e 
logic hardwar e s e ction to the corr e sponding stat e data storag e unit in th e incoming 
programmabl e logic hardwar e s e ction including , wherein said state data relocation means 
comprises : 

relocation address storage writable by said monitoring device, corresponding with 

said state data storage units, 

secondary state data storage to save data from said state data storage units, 
selection means for selecting to s e l e ct either a non-relocated address or a 

relocated address with which to access the said secondary state data storage, and 
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data relocation means for p erformin g, within one said data access interval the 
steps of: 

(i) loading said r e location address storag e with addr e ss e s suppli e d by said 

monitoring d e vic e ; and within on e said data access int e rval, 
reading a state data bit from a programmable logic hardware section, 

(nm) writing said state data bit into said secondary state data storage at an 
address stored in said relocation address storage, 

(iii w) repeating steps (iji) and (ii***) until all required bits have been relocated 
and transferred, 

(iy_v) reading a state data bit from said secondary state data storage, 

(vvi) writing said state data bit into the same or a different programmable logic 

hardware section at the same address at which it was located in said 

secondary state data storage, and 
(vi_vii) repeating steps (|y_v) and (vvi) until all required bits have been transferred. 

Claim 25. (previously presented) The programmable controller as claimed in claim 22 
including means to support state data modification comprising: 

secondary modification data storage corresponding to said state data storage units, 

and 

a modification indicator corresponding to each said state data storage unit, said 
modification indicator and the contents of said secondary storage being writable by said 
monitoring device; and 

data modification means operative to perform within one said data access interval 
the steps of: 

scanning said modification indicators, 

loading data stored in said secondary modification data storage units to said 
corresponding state data storage units if the corresponding modification indicator so 
indicates, and 

resetting said modification indicators. 

Claim 26. (currently amended) The programmable controller as claimed in claim 22 

including means to support state data forcing comprising: 
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secondary modification data storage corresponding with said state data storage units; 

a data forcing indicator for each said storage unit, said data forcing indicator and the 
contents of said secondary storage being writable by said monitoring device; and 

data modification means for performing operativ e to p e rform within one said data 
access interval the steps of: 

scanning said data forcing indicators, 

loading data stored in said secondary storage units to said corresponding state data 
storage units if the corresponding data forcing indicator so indicates, 
without resetting said data forcing indicators. 

Claim 27. (currently amended) The programmable controller as claimed in claim 22 

including means to support program swap operations, for performin g adaptod to perform , 

during said data access interval, the steps of: 

reading and storing state data from said state data storage units, 

configuring a new user control program in said programmable logic by 

reconfiguring said programmable connections; and 

writing said stored state data, or modified stored state data, to corresponding newly 

configured state data storage units. 

Claim 28. (new) The programmable controller as claimed in claim 27 including 
means to support relocation of state data from the outgoing programmable logic hardware 
section to the corresponding state data storage unit in the incoming programmable logic 
hardware section including: 

relocation address storage corresponding with said state data storage units, 
secondary state data storage to save data from said state data storage units, 
selection means to select either a non-relocated address or a relocated address 
with which to access the said secondary state data storage, and 
data relocation means performing the steps of: 

(i) loading said relocation address storage with addresses supplied by said 
monitoring device; and within one said data access interval, 

(ii) reading a state data bit from a programmable logic hardware section, 
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(iii) writing said state data bit into said secondary state data storage at an 
address stored in said relocation address storage, 

(iv) repeating steps (ii) and (iii) until all required bits have been relocated and 
transferred, 

(v) reading a state data bit from said secondary state data storage, 

(vi) writing said state data bit into the same or a different programmable logic 
hardware section at the same address at which it was located in said 
secondary state data storage, and 

(vii) repeating steps (v) and (vi) until all required bits have been transferred. 

Claim 29. (new) The programmable controller as claimed in claim 4 with duplicated 
hardware to facilitate program swapping operations including: 

at least two separately configurable sections of programmable logic hardware for 
separately configurable user control program circuits, 

output selector means to selectively connect one of said programmable logic 
hardware sections to said output interfaces via the output register, 

an outgoing user control program in a said section of the programmable logic 
hardware connected to said output interface and, 

a new user control program in another said programmable logic hardware section 
not connected to said output interface. 

Claim 30. (new) The programmable controller as claimed in claim 29 including: 

state data from the outgoing said programmable logic hardware section written to 
the state data storage units of said programmable hardware section holding said new user 
control program that have the same user control program functions as those from which it 
was read. 
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